-- This script may be used with the auth-filter.
--
-- Requirements:
-- luacrypto >= 0.3
--
-- luaposix
--
--
local sysstat = require("posix.sys.stat")
local unistd = require("posix.unistd")
local crypto = require("crypto")
-- This file should contain a series of lines in the form of:
-- username1:hash1
-- username2:hash2
-- username3:hash3
-- ...
-- Hashes can be generated using something like `mkpasswd -m sha-512 -R 300000`.
-- This file should not be world-readable.
local users_filename = "/etc/cgit-auth/users"
-- This file should contain a series of lines in the form of:
-- groupname1:username1,username2,username3,...
-- ...
local groups_filename = "/etc/cgit-auth/groups"
-- This file should contain a series of lines in the form of:
-- reponame1:groupname1,groupname2,groupname3,...
-- ...
local repos_filename = "/etc/cgit-auth/repos"
-- Set this to a path this script can write to for storing a persistent
-- cookie secret, which should not be world-readable.
local secret_filename = "/var/cache/cgit/auth-secret"
--
--
-- Authentication functions follow below. Swap these out if you want different authentication semantics.
--
--
-- Looks up a hash for a given user.
function lookup_hash(user)
local line
for line in io.lines(users_filename) do
local u, h = string.match(line, "(.-):(.+)")
if u:lower() == user:lower() then
return h
end
end
return nil
end
-- Looks up users for a given repo.
function lookup_users(repo)
local users = nil
local groups = nil
local line, group, user
for line in io.lines(repos_filename) do
local r, g = string.match(line, "(.-):(.+)")
if r == repo then
groups = { }
for group in string.gmatch(g, "([^,]+)") do
groups[group:lower()] = true
end
break
end
end
if groups == nil then
return nil
end
for line in io.lines(groups_filename) do
local g, u = string.match(line, "(.-):(.+)")
if groups[g:lower()] then
if users == nil then
users = { }
end
for user in string.gmatch(u, "([^,]+)") do
users[user:lower()] = true
end
end
end
return users
end
-- Sets HTTP cookie headers based on post and sets up redirection.
function authenticate_post()
local hash = lookup_hash(post["username"])
local redirect = validate_value("redirect", post["redirect"])
if redirect == nil then
not_found()
return 0
end
redirect_to(redirect)
if hash == nil or hash ~= unistd.crypt(post["password"], hash) then
set_cookie("cgitauth", "")
else
-- One week expiration time
local username = secure_value("username", post["username"], os.time() + 604800)
set_cookie("cgitauth", username)
end
html("\n")
return 0
end
-- Returns 1 if the cookie is valid and 0 if it is not.
function authenticate_cookie()
accepted_users = lookup_users(cgit["repo"])
if accepted_users == nil then
-- We return as valid if the repo is not protected.
return 1
end
local username = validate_value("username", get_cookie(http["cookie"], "cgitauth"))
if username == nil or not accepted_users[username:lower()] then
return 0
else
return 1
end
end
-- Prints the html for the login form.
function body()
html("